Security Enclave Processor for a System on a Chip

Abstract

An SOC implements a security enclave processor (SEP). The SEP may include a processor and one or more security peripherals. The SEP may be isolated from the rest of the SOC (e.g. one or more central processing units (CPUs) in the SOC, or application processors (APs) in the SOC). Access to the SEP may be strictly controlled by hardware. For example, a mechanism in which the CPUs / APs can only access a mailbox location in the SEP is described. The CPU / AP may write a message to the mailbox, which the SEP may read and respond to. The SEP may include one or more of the following in some embodiments: secure key management using wrapping keys, SEP control of boot and / or power management, and separate trust zones in memory.

Description

BACKGROUND[0001]1. Field of the Invention[0002]This invention is related to the field of systems on a chip (SOCs), and more particularly to security on SOCs and devices that employ SOCs.[0003]2. Description of the Related Art[0004]As the number of transistors that can be incorporated on a single semiconductor substrate “chip” continues to increase, the variety and complexity of functionality on the chip continues to increase as well. One way in which the available transistors can be used is to form an SOC. The SOC generally includes one or more processors and various other components (e.g. one or more memory controllers, various peripheral components, etc.).[0005]Because SOCs incorporate significant functionality in a small form factor, and because SOCs can be made power efficient, SOCs are a popular device to include in portable electronic devices such a portable phones (cell phones), smart phones, personal digital assistants (PDAs), tablet computers, etc. These portable electronic...

AI Technical Summary

Benefits of technology

The patent text describes a system where a special chip called an SEP is in control of its own boot. This means that the SEP can modify its own code without being compromised. The SEP has a secure read-only memory (ROM) where all the code it executes is stored. This secure ROM is smaller than the regular ROM in the main chip, and it is only accessible from the SEP. The processor in the SEP runs directly from this secure ROM, which reduces the risk of the code being copied to a memory that can be modified. This setup makes the SEP a less vulnerable target for attacks.

Problems solved by technology

As the number of transistors that can be incorporated on a single semiconductor substrate “chip” continues to increase, the variety and complexity of functionality on the chip continues to increase as well.

All other access to the SEP may not be possible in a production part.

Insecure software may not have access to the actual key.

However, clock gating / power gating may not be forced from the outside of the SEP (other than when the entire SOC is powered off).

Images